Pub. 5 Issue 2

23 T he California Consumer Privacy Act (CCPA), which goes into effect January 1, 2020, imposes new privacy regulations on businesses throughout California. It will affect how businesses interact with consumers as well as employees. Which businesses does the CCPA apply to? Generally, the CCPA applies to all for-profit entities that col- lect and process the personal information of California residents, and that meet at least one of the following criteria: (1) $25 mil- lion annual gross revenue, (2) 50 percent revenue derived from selling personal information, or (3) annually receiving, buying, or sharing personal information about 50,000 consumers. Does the CCPA apply to your business? The CCPA is very broad. “Collect” means gather, receive, obtain, buy, rent, or access any personal information about a consumer by any means. This includes receiving personal in- formation from a consumer, either actively or passively, or by observing the consumer’s behavior. “Personal information” means information that identifies, or could reasonably be linked, directly or indirectly to a particular consumer or household. This includes information in one or more common categories such as name, social security number, address, and bank information, as well as broader categories like IP address, email address, account name, purchasing history, internet activity, and geolocation data. As an example, if a business collects the IP addresses of visi- tors to its website and that website receives 137 unique visitors per day, which is slightly more than 50,000 IP addresses per year, then the CCPA applies based on the third criteria listed above. CALIFORNIA’S SWEEPING NEW PRIVACY LAWS TAKE EFFECT IN 2020